milestone 1.0.0: approval-path security, build-integrity guard, e2e harness and filter coverage #190
Reference in New Issue
Block a user
Delete Branch "next"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Milestone PR:
next->main.nextcarries one squashed commit per closed issue and is kept green and mergeable, so this can be merged without notice.Milestone 1.0.0 is complete: 61 issues closed, 0 open. 56 units landed on
next.Verified by me on the head of
nextatff3387d:make checkgreen — 31 suites, 748 tests,script/test-verify-build18 cases,check-censored137 tracked files + 16 underdist/, ESLint and prettier clean.make test-e2e52/52 (Chrome),make test-e2e-firefox8/8, both exit 0.make build— 4 bundles, every one verifiedDEBUGcompiled off.Every unit passed an independent adversarial review before landing; several needed three to five rounds because each round found a real defect.
Approval and signing path
fromis pinned to the address named at approval time.-32603instead of leavingwindow.ethereum.request()pending forever, and reports the phase it actually failed in (#280).Key and secret handling
Phishing blocklist — vendored and censored at build time
#219. The runtime fetch is gone, along with its delta/persistence machinery and the alarm that drove it. The list is fetched at build time from a hash-pinned upstream commit, its sha256 asserted against a recorded expectation, and stored as truncated sha256 digests — every domain kept, no domain name shipped.
dist/fell from 18.9 MB to 8.9 MB.Read this before tagging: the blocklist no longer self-updates every 24 hours. It is now only as fresh as the last build, and a refresh reaches users through
make vendor-blocklist-> commit -> release. That trade was taken deliberately — it removes a third party's live control over what this wallet warns users about, and the IP leak of fetching it — but it makes blocklist freshness a release-cadence obligation. If that is the wrong trade, a hosted mirror is the fix and this is the moment to say so.Token filtering
$0.00(#261).Correctness and UI
Verification infrastructure
make check, containerized (#152) — the gate wasprettier --checkonly, which is how the undefined-identifier defects in #150 and #151 shipped. Reintroducing either is now caught asno-undef.verify-buildfailure-mode battery wired intomake check(#227); DEBUG asserted off in every emitted bundle (#170).Known gaps, all tracked, none in this milestone
TX_RESPONSEis honoured — is untouched.TODO.mdentry makes every merge invalidate every open PR (#222) — a throughput cost, awaiting your call, not a blocker.@clawbot is #286 in this? i’d like it asap
milestone 1.0.0: approval-path security, build-integrity guard, e2e harness and filter coverageto WIP: milestone 1.0.0: approval-path security, build-integrity guard, e2e harness and filter coverageHeld
WIP:and reassigned: a deployability audit ofnext@ff3387dfound nine blockers, filed as #304 through #312 in milestone 1.0.0. Verdict and evidence: #303 (comment)Two destroy funds in ordinary use with no attacker: a dApp approval window silently deletes a wallet added while it was open (#304), and the popup's own ERC-20 send signs an amount it never displayed — screen
0.25, artifact250000000000000000(#305). There is also no packaged artifact and no signing, so the extension cannot be installed durably on either browser (#310).The milestone was empty because the pre-1.0 security review this PR's own body names as not done was not attached to it. It is now.
WIP:comes off and the label returns tomerge-readywhen those nine close.Answering your 2026-08-17 question, which went unanswered — apologies for the delay.
Yes. #286 (ESLint in
script/lint, containerized) merged tonextat 2026-08-17 09:10, merge commit47bf386, about an hour after you asked. This PR's head ISnext, so it is included here.Caveat, since you wanted it ASAP: it is on
next, not onmain. It reachesmainonly when this PR merges, and this PR is now heldWIP:behind the nine deployability blockers filed today (#304 through #312). If you want the lint work onmainsooner than those nine close, say so and I will cherry-pick it onto a small PR of its own — it is self-contained and touches no wallet logic.Both methods answered from the module-level state singleton, which the MV3 worker never populates, so a cold worker reported mainnet 0x1 to a page whose user was on Sepolia. They now answer from getState(), the per-call detached storage read the other read handlers already use. An earlier revision of this fix used loadState() instead and was rejected in review: it replaces the whole singleton, and these methods are page-callable with no connection gate (inpage.js sends eth_chainId on every page load), so a load landing inside backgroundRefresh()'s network round trip detached the address objects being mutated in place — persisting pre-refresh balances while still stamping lastBalanceRefresh, letting a polling page suppress background refreshes indefinitely. The test stub now structured-clones on get and set, as chrome.storage.local does. The aliasing stub it replaces was independently measured to hide this defect class entirely: with the aliasing get restored and the defective handler in place, the suite passes 794/794. Verified failing first three ways: a plain singleton read fails the three cold-worker cases; the rejected loadState() revision fails only the new mid-refresh case ("1.5" expected, "0" received); moving saveState() ahead of refreshBalances() fails that case and only it.WIP: milestone 1.0.0: approval-path security, build-integrity guard, e2e harness and filter coverageto milestone 1.0.0: approval-path security, build-integrity guard, e2e harness and filter coverage